So, I have 2 bank accounts that I usually do transactions in. One is the Development Bank of Singapore (DBS) and the other is United Overseas Bank (UOB) . I was on an overseas business trip and then I had to check my account balance with DBS online. Then I realized that I cannot because I did not bring the DBS 2-Factor Authentication (2FA) Physical token, also known as hard-token with me. I ended up not doing what I need to do and had to return home to check my account balance. I was initially irked when DBS took matter into their own hands and decided what is good for their customers BUT this incident blew my top. A quick look at their FAQ reveals the below snippets As you can see from here, "DBS decided to go with ...". I am surprised that for a world-class bank that prides itself on customer-standards, they are taking matters into their own hands and deciding for the customer. Shouldnt the customer be able to decide this for themselves ? By the same token (pun intended), let us take a look at UOB's FAQ below: A-HA ! A choice was not made but given. Customers are given the choice to deicde what they want. If they prefer not to carry too many devices with them (God knows how many we have to carry these days - USB Thumb Drives, iPods, mobile phones, keys, etc) and prefer to leverage on what they are already comfortable in carrying, they can choose their mobile phones to receive the One-Time-Passwords (OTP) va a SMS. If they are going to be in a country whereby their auto-roaming GSM doesnt work (such as the different networks in Japan or Korea), they can opt for the hard-token. To cut it short - No decision was made for the customer . Instead, a choice was given to the customer . In other words, UOB empowers their customers, unlike DBS, who thinks they are better themselves by making a decision for the customer. Shame on you. While I have some suspicions that cost (of sending the SMSes) may be a determining factor, I dont see UOB relenting on that point and they dont own a telco either. They have perfected the art of: If you keep your customers first, their money will come in . This issue, by no means, has got anything to do with security. Both banks are practicing it - by making sure there is another authentication factor before logging for banking transactions. This is about choice, empowerment and delegation. In short, it is about being customer-focused, in every sense of the word. UOB's FAQ details very well about the operations of both sets of authentication Read More...